diff -urNp old/analyzer/pgmtexture.c new/analyzer/pgmtexture.c

--- old/analyzer/pgmtexture.c	2017-09-05 15:09:00.975207528 +0200

+++ new/analyzer/pgmtexture.c	2017-09-05 15:11:44.193390835 +0200

@@ -97,7 +97,7 @@ vector(unsigned int const nl,

     float * v;

     assert(nh >= nl);

-

+    overflow_add(nh - nl, 1);

     MALLOCARRAY(v, (unsigned) (nh - nl + 1));

     if (v == NULL)

@@ -129,6 +129,7 @@ matrix (unsigned int const nrl,

     assert(nrh >= nrl);

     /* allocate pointers to rows */

+    overflow_add(nrh - nrl, 1);

     MALLOCARRAY(m, (unsigned) (nrh - nrl + 1));

     if (m == NULL)

         pm_error("Unable to allocate memory for a matrix.");

@@ -137,6 +138,7 @@ matrix (unsigned int const nrl,

     assert (nch >= ncl);

+    overflow_add(nch - ncl, 1);

     /* allocate rows and set pointers to them */

     for (i = nrl; i <= nrh; ++i) {

         MALLOCARRAY(m[i], (unsigned) (nch - ncl + 1));

diff -urNp old/converter/other/gemtopnm.c new/converter/other/gemtopnm.c

--- old/converter/other/gemtopnm.c	2017-09-05 15:09:00.990207453 +0200

+++ new/converter/other/gemtopnm.c	2017-09-05 15:12:20.786208419 +0200

@@ -106,6 +106,7 @@ main(argc, argv)

 	pnm_writepnminit( stdout, cols, rows, MAXVAL, type, 0 );

+    overflow_add(cols, padright);

     { 

         /* allocate input row data structure */

         int plane;

diff -urNp old/converter/other/jpegtopnm.c new/converter/other/jpegtopnm.c

--- old/converter/other/jpegtopnm.c	2017-09-05 15:09:00.993207438 +0200

+++ new/converter/other/jpegtopnm.c	2017-09-05 15:13:02.322001620 +0200

@@ -862,6 +862,8 @@ convertImage(FILE *

     /* Calculate output image dimensions so we can allocate space */

     jpeg_calc_output_dimensions(cinfoP);

+    overflow2(cinfoP->output_width, cinfoP->output_components);

+

     /* Start decompressor */

     jpeg_start_decompress(cinfoP);

diff -urNp old/converter/other/pbmtopgm.c new/converter/other/pbmtopgm.c

--- old/converter/other/pbmtopgm.c	2017-09-05 15:09:00.991207448 +0200

+++ new/converter/other/pbmtopgm.c	2017-09-05 15:13:32.640850830 +0200

@@ -47,6 +47,7 @@ main(int argc, char *argv[]) {

                  "than the image height (%u rows)", height, rows);

     outrow = pgm_allocrow(cols) ;

+    overflow2(width, height);

     maxval = MIN(PGM_OVERALLMAXVAL, width*height);

     pgm_writepgminit(stdout, cols, rows, maxval, 0) ;

diff -urNp old/converter/other/pnmtoddif.c new/converter/other/pnmtoddif.c

--- old/converter/other/pnmtoddif.c	2017-09-05 15:09:00.991207448 +0200

+++ new/converter/other/pnmtoddif.c	2017-09-05 15:14:34.400564239 +0200

@@ -629,6 +629,7 @@ main(int argc, char *argv[]) {

     switch (PNM_FORMAT_TYPE(format)) {

     case PBM_TYPE:

         ip.bits_per_pixel = 1;

+        overflow_add(cols, 7);

         ip.bytes_per_line = (cols + 7) / 8;

         ip.spectral = 2;

         ip.components = 1;

@@ -644,6 +645,7 @@ main(int argc, char *argv[]) {

         ip.polarity = 2;

         break;

     case PPM_TYPE:

+	overflow2(cols, 3);

         ip.bytes_per_line = 3 * cols;

         ip.bits_per_pixel = 24;

         ip.spectral = 5;

diff -urNp old/converter/other/pnmtojpeg.c new/converter/other/pnmtojpeg.c

--- old/converter/other/pnmtojpeg.c	2017-09-05 15:09:00.992207443 +0200

+++ new/converter/other/pnmtojpeg.c	2017-09-05 15:16:52.065875364 +0200

@@ -606,7 +606,11 @@ read_scan_script(j_compress_ptr const ci

            want JPOOL_PERMANENT.  

         */

         const unsigned int scan_info_size = nscans * sizeof(jpeg_scan_info);

-        jpeg_scan_info * const scan_info = 

+        const jpeg_scan_info * scan_info;

+

+        overflow2(nscans, sizeof(jpeg_scan_info));

+

+        scan_info = 

             (jpeg_scan_info *)

             (*cinfo->mem->alloc_small) ((j_common_ptr) cinfo, JPOOL_IMAGE,

                                         scan_info_size);

@@ -938,6 +942,8 @@ compute_rescaling_array(JSAMPLE ** const

   const long half_maxval = maxval / 2;

   long val;

+  overflow_add(maxval, 1);

+  overflow2(maxval+1, sizeof(JSAMPLE));

   *rescale_p = (JSAMPLE *)

     (cinfo.mem->alloc_small) ((j_common_ptr) &cinfo, JPOOL_IMAGE,

                               (size_t) (((long) maxval + 1L) * 

@@ -1016,6 +1022,7 @@ convert_scanlines(struct jpeg_compress_s

     */

   /* Allocate the libpnm output and compressor input buffers */

+  overflow2(cinfo_p->image_width, cinfo_p->input_components);

   buffer = (*cinfo_p->mem->alloc_sarray)

     ((j_common_ptr) cinfo_p, JPOOL_IMAGE,

      (unsigned int) cinfo_p->image_width * cinfo_p->input_components, 

diff -urNp old/converter/other/pnmtops.c new/converter/other/pnmtops.c

--- old/converter/other/pnmtops.c	2017-09-05 15:09:00.993207438 +0200

+++ new/converter/other/pnmtops.c	2017-09-05 15:18:52.602038826 +0200

@@ -293,18 +293,22 @@ parseCommandLine(int argc, const char **

     validateCompDimension(width, 72, "-width value");

     validateCompDimension(height, 72, "-height value");

-    

+

+    overflow2(width, 72);    

     cmdlineP->width  = width * 72;

+    overflow2(height, 72);

     cmdlineP->height = height * 72;

     if (imagewidthSpec) {

         validateCompDimension(imagewidth, 72, "-imagewidth value");

+	overflow2(imagewidth, 72);

         cmdlineP->imagewidth = imagewidth * 72;

     }

     else

         cmdlineP->imagewidth = 0;

     if (imageheightSpec) {

-        validateCompDimension(imagewidth, 72, "-imageheight value");

+        validateCompDimension(imageheight, 72, "-imageheight value");

+	overflow2(imageheight, 72);

         cmdlineP->imageheight = imageheight * 72;

     }

     else

diff -urNp old/converter/other/pnmtorle.c new/converter/other/pnmtorle.c

--- old/converter/other/pnmtorle.c	2017-09-05 15:09:00.993207438 +0200

+++ new/converter/other/pnmtorle.c	2017-09-05 15:19:42.218061079 +0200

@@ -19,6 +19,8 @@

  * If you modify this software, you should include a notice giving the

  * name of the person performing the modification, the date of modification,

  * and the reason for such modification.

+ *

+ * 2002-12-19: Fix maths wrapping bugs. Alan Cox <alan@redhat.com>

  */

 /*

  * pnmtorle - A program which will convert pbmplus (ppm or pgm) images

diff -urNp old/converter/other/pnmtosgi.c new/converter/other/pnmtosgi.c

--- old/converter/other/pnmtosgi.c	2017-09-05 15:09:00.992207443 +0200

+++ new/converter/other/pnmtosgi.c	2017-09-05 15:23:54.121864563 +0200

@@ -139,6 +139,8 @@ compress(ScanElem *   const tempArg,

         break;

     case STORAGE_RLE: {

         unsigned int const tabrow = chanNum * rows + row;

+	overflow2(chanNum, rows);

+	overflow_add(chanNum * rows, row);

         unsigned int len;

         size_t lenBytes;

@@ -185,6 +187,7 @@ buildChannels(FILE *       const ifP,

     ScanElem * temp;

     if (storage != STORAGE_VERBATIM) {

+        overflow2(channels, rows);

         MALLOCARRAY_NOFAIL(table, channels * rows);

     } else

         table = NULL;

diff -urNp old/converter/other/rletopnm.c new/converter/other/rletopnm.c

--- old/converter/other/rletopnm.c	2017-09-05 15:09:00.991207448 +0200

+++ new/converter/other/rletopnm.c	2017-09-05 15:24:29.441803825 +0200

@@ -19,6 +19,8 @@

  * If you modify this software, you should include a notice giving the

  * name of the person performing the modification, the date of modification,

  * and the reason for such modification.

+ *

+ * 2002-12-19: Fix maths wrapping bugs. Alan Cox <alan@redhat.com>

  */

 /*

  * rletopnm - A conversion program to convert from Utah's "rle" image format

diff -urNp old/converter/other/sgitopnm.c new/converter/other/sgitopnm.c

--- old/converter/other/sgitopnm.c	2017-09-05 15:09:00.991207448 +0200

+++ new/converter/other/sgitopnm.c	2017-09-05 15:26:59.320478129 +0200

@@ -377,10 +377,14 @@ readChannels(FILE *       const ifP,

         MALLOCARRAY_NOFAIL(image, head->ysize);

     } else {

         maxchannel = 3;

+        overflow2(head->ysize, maxchannel);

         MALLOCARRAY_NOFAIL(image, head->ysize * maxchannel);

     }

-    if (table)

+    if (table) {

+        overflow2(head->xsize, 2);

+        overflow_add(head->xsize*2, 2);

         MALLOCARRAY_NOFAIL(temp, WORSTCOMPR(head->xsize));

+    }

     for (channel = 0; channel < maxchannel; ++channel) {

         unsigned int row;

diff -urNp old/converter/other/sirtopnm.c new/converter/other/sirtopnm.c

--- old/converter/other/sirtopnm.c	2017-09-05 15:09:00.993207438 +0200

+++ new/converter/other/sirtopnm.c	2017-09-05 15:27:29.784400243 +0200

@@ -69,6 +69,7 @@ char* argv[];

 	    }

 	    break;

 	case PPM_TYPE:

+            overflow3(cols, rows, 3);

 	    picsize = cols * rows * 3;

 	    planesize = cols * rows;

             if ( !( sirarray = (unsigned char*) malloc( picsize ) ) ) 

diff -urNp old/converter/other/tifftopnm.c new/converter/other/tifftopnm.c

--- old/converter/other/tifftopnm.c	2017-09-05 15:09:00.991207448 +0200

+++ new/converter/other/tifftopnm.c	2017-09-05 15:29:34.649047220 +0200

@@ -1372,7 +1372,9 @@ convertRasterByRows(pnmOut *       const

     if (scanbuf == NULL)

         pm_error("can't allocate memory for scanline buffer");

-    MALLOCARRAY(samplebuf, cols * spp);

+    /* samplebuf is unsigned int * !!! */

+    samplebuf = (unsigned int *) malloc3(cols , sizeof(unsigned int) , spp);

+

     if (samplebuf == NULL)

         pm_error("can't allocate memory for row buffer");

diff -urNp old/converter/other/xwdtopnm.c new/converter/other/xwdtopnm.c

--- old/converter/other/xwdtopnm.c	2017-09-05 15:09:00.994207433 +0200

+++ new/converter/other/xwdtopnm.c	2017-09-05 15:30:51.608806353 +0200

@@ -210,6 +210,10 @@ processX10Header(X10WDFileHeader *  cons

         *colorsP = pnm_allocrow(2);

         PNM_ASSIGN1((*colorsP)[0], 0);

         PNM_ASSIGN1((*colorsP)[1], *maxvalP);

+        overflow_add(h10P->pixmap_width, 15);

+        if(h10P->pixmap_width < 0)

+            pm_error("assert: negative width");

+        overflow2((((h10P->pixmap_width + 15) / 16) * 16 - h10P->pixmap_width), 8);

         *padrightP =

             (((h10P->pixmap_width + 15) / 16) * 16 - h10P->pixmap_width) * 8;

         *bits_per_itemP = 16;

@@ -635,6 +639,7 @@ processX11Header(X11WDFileHeader *  cons

     *colsP = h11FixedP->pixmap_width;

     *rowsP = h11FixedP->pixmap_height;

+    overflow2(h11FixedP->bytes_per_line, 8);

     *padrightP =

         h11FixedP->bytes_per_line * 8 -

         h11FixedP->pixmap_width * h11FixedP->bits_per_pixel;

diff -urNp old/converter/pbm/mdatopbm.c new/converter/pbm/mdatopbm.c

--- old/converter/pbm/mdatopbm.c	2017-09-05 15:09:00.988207463 +0200

+++ new/converter/pbm/mdatopbm.c	2017-09-05 15:31:47.007612804 +0200

@@ -245,10 +245,13 @@ main(int argc, char **argv) {

         pm_readlittleshort(infile, &yy;; nInCols = yy;

     }

+    overflow2(nOutCols, 8);

     nOutCols = 8 * nInCols;

     nOutRows = nInRows;

-    if (bScale) 

+    if (bScale) {

+        overflow2(nOutRows, 2);

         nOutRows *= 2;

+    }

     data = pbm_allocarray(nOutCols, nOutRows);

diff -urNp old/converter/pbm/mgrtopbm.c new/converter/pbm/mgrtopbm.c

--- old/converter/pbm/mgrtopbm.c	2017-09-05 15:09:00.988207463 +0200

+++ new/converter/pbm/mgrtopbm.c	2017-09-05 15:32:29.335457328 +0200

@@ -65,6 +65,8 @@ readMgrHeader(FILE *          const ifP,

     if (head.h_high < ' ' || head.l_high < ' ')

         pm_error("Invalid width field in MGR header");

+    overflow_add(*colsP, pad);

+

     *colsP = (((int)head.h_wide - ' ') << 6) + ((int)head.l_wide - ' ');

     *rowsP = (((int)head.h_high - ' ') << 6) + ((int) head.l_high - ' ');

     *padrightP = ( ( *colsP + pad - 1 ) / pad ) * pad - *colsP;

diff -urNp old/converter/pbm/pbmtogem.c new/converter/pbm/pbmtogem.c

--- old/converter/pbm/pbmtogem.c	2017-09-05 15:09:00.988207463 +0200

+++ new/converter/pbm/pbmtogem.c	2017-09-05 15:33:20.015266347 +0200

@@ -79,6 +79,7 @@ putinit (int const rows, int const cols)

   bitsperitem = 0;

   bitshift = 7;

   outcol = 0;

+  overflow_add(cols, 7);

   outmax = (cols + 7) / 8;

   outrow = (unsigned char *) pm_allocrow (outmax, sizeof (unsigned char));

   lastrow = (unsigned char *) pm_allocrow (outmax, sizeof (unsigned char));

diff -urNp old/converter/pbm/pbmtogo.c new/converter/pbm/pbmtogo.c

--- old/converter/pbm/pbmtogo.c	2017-09-05 15:09:00.988207463 +0200

+++ new/converter/pbm/pbmtogo.c	2017-09-05 15:33:44.200173491 +0200

@@ -158,6 +158,7 @@ main(int           argc,

     bitrow = pbm_allocrow(cols);

     /* Round cols up to the nearest multiple of 8. */

+    overflow_add(cols, 7);

     rucols = ( cols + 7 ) / 8;

     bytesperrow = rucols;       /* GraphOn uses bytes */

     rucols = rucols * 8;

diff -urNp old/converter/pbm/pbmtolj.c new/converter/pbm/pbmtolj.c

--- old/converter/pbm/pbmtolj.c	2017-09-05 15:09:00.987207468 +0200

+++ new/converter/pbm/pbmtolj.c	2017-09-05 15:34:35.767972087 +0200

@@ -120,7 +120,11 @@ parseCommandLine(int argc, char ** argv,

 static void

 allocateBuffers(unsigned int const cols) {

+    overflow_add(cols, 8);

     rowBufferSize = (cols + 7) / 8;

+    overflow_add(rowBufferSize, 128);

+    overflow_add(rowBufferSize, rowBufferSize+128);

+    overflow_add(rowBufferSize+10, rowBufferSize/8);

     packBufferSize = rowBufferSize + (rowBufferSize + 127) / 128 + 1;

     deltaBufferSize = rowBufferSize + rowBufferSize / 8 + 10;

diff -urNp old/converter/pbm/pbmtomda.c new/converter/pbm/pbmtomda.c

--- old/converter/pbm/pbmtomda.c	2017-09-05 15:09:00.987207468 +0200

+++ new/converter/pbm/pbmtomda.c	2017-09-05 15:47:39.279563827 +0200

@@ -179,6 +179,8 @@ int main(int argc, char **argv)

     nOutRowsUnrounded = bScale ? nInRows/2 : nInRows;

+    overflow_add(nOutRowsUnrounded, 3);

+

     nOutRows = ((nOutRowsUnrounded + 3) / 4) * 4;

         /* MDA wants rows a multiple of 4 */   

     nOutCols = nInCols / 8;

diff -urNp old/converter/pbm/pbmtoppa/pbm.c new/converter/pbm/pbmtoppa/pbm.c

--- old/converter/pbm/pbmtoppa/pbm.c	2017-09-05 15:09:00.990207453 +0200

+++ new/converter/pbm/pbmtoppa/pbm.c	2017-09-05 15:49:13.364155211 +0200

@@ -106,6 +106,7 @@ int pbm_readline(pbm_stat* pbm,unsigned

     return 0;

   case P4:

+    overflow_add(pbm->width, 7);

     tmp=(pbm->width+7)/8;

     tmp2=fread(data,1,tmp,pbm->fptr);

     if(tmp2 == tmp)

@@ -130,7 +131,8 @@ void pbm_unreadline (pbm_stat *pbm, void

     return;

   pbm->unread = 1;

-  pbm->revdata = malloc ((pbm->width+7)/8);

+  overflow_add(pbm->width, 7);

+  pbm->revdata = malloc((pbm->width+7)/8);

   memcpy (pbm->revdata, data, (pbm->width+7)/8);

   pbm->current_line--;

 }

diff -urNp old/converter/pbm/pbmtoppa/pbmtoppa.c new/converter/pbm/pbmtoppa/pbmtoppa.c

--- old/converter/pbm/pbmtoppa/pbmtoppa.c	2017-09-05 15:09:00.990207453 +0200

+++ new/converter/pbm/pbmtoppa/pbmtoppa.c	2017-09-05 15:50:10.811968059 +0200

@@ -453,6 +453,7 @@ main(int argc, char *argv[]) {

             pm_error("main(): unrecognized parameter '%s'", argv[argn]);

     }

+    overflow_add(Width, 7);

     Pwidth=(Width+7)/8;

     printer.fptr=out;

diff -urNp old/converter/pbm/pbmtoxbm.c new/converter/pbm/pbmtoxbm.c

--- old/converter/pbm/pbmtoxbm.c	2017-09-05 15:09:00.987207468 +0200

+++ new/converter/pbm/pbmtoxbm.c	2017-09-05 15:51:01.843793892 +0200

@@ -353,6 +353,8 @@ convertRaster(FILE *          const ifP,

     unsigned char * bitrow;

     unsigned int row;

+    overflow_add(cols, padright);

+

     putinit(xbmVersion);

     bitrow = pbm_allocrow_packed(cols + padright);

diff -urNp old/converter/pbm/pbmto4425.c new/converter/pbm/pbmto4425.c

--- old/converter/pbm/pbmto4425.c	2017-09-05 15:09:00.988207463 +0200

+++ new/converter/pbm/pbmto4425.c	2017-09-05 15:54:37.077992604 +0200

@@ -160,7 +160,7 @@ main(int argc, char * argv[]) {

     xres = vmap_width * 2;

     yres = vmap_height * 3;

-    vmap = malloc(vmap_width * vmap_height * sizeof(char));

+    vmap = malloc3(vmap_width, vmap_height, sizeof(char));

     if(vmap == NULL)

 	{

         pm_error( "Cannot allocate memory" );

diff -urNp old/converter/pbm/pktopbm.c new/converter/pbm/pktopbm.c

--- old/converter/pbm/pktopbm.c	2017-09-05 15:09:00.988207463 +0200

+++ new/converter/pbm/pktopbm.c	2017-09-05 15:55:35.736759083 +0200

@@ -280,6 +280,7 @@ main(int argc, char *argv[]) {

         if (flagbyte == 7) {            /* long form preamble */

             integer packetlength = get32() ;    /* character packet length */

             car = get32() ;         /* character number */

+            overflow_add(packetlength, pktopbm_pkloc);

             endofpacket = packetlength + pktopbm_pkloc;

                 /* calculate end of packet */

             if ((car >= MAXPKCHAR) || !filename[car]) {

diff -urNp old/converter/pbm/thinkjettopbm.l new/converter/pbm/thinkjettopbm.l

--- old/converter/pbm/thinkjettopbm.l	2017-09-05 15:09:00.988207463 +0200

+++ new/converter/pbm/thinkjettopbm.l	2017-09-05 15:57:03.449400388 +0200

@@ -114,7 +114,9 @@ DIG             [0-9]

 <RASTERMODE>\033\*b{DIG}+W  {

                             int l;

                             if (rowCount >= rowCapacity) {

+                                overflow_add(rowCapacity, 100);

                                 rowCapacity += 100;

+                                overflow2(rowCapacity, sizeof *rows);

                                 rows = realloc (rows, rowCapacity * sizeof *rows);

                                 if (rows == NULL)

                                     pm_error ("Out of memory.");

@@ -226,6 +228,7 @@ yywrap (void)

     /*

      * Quite simple since ThinkJet bit arrangement matches PBM

      */

+    overflow2(maxRowLength, 8);

     pbm_writepbminit(stdout, maxRowLength*8, rowCount, 0);

     packed_bitrow = malloc(maxRowLength);

diff -urNp old/converter/pgm/lispmtopgm.c new/converter/pgm/lispmtopgm.c

--- old/converter/pgm/lispmtopgm.c	2017-09-05 15:09:01.002207393 +0200

+++ new/converter/pgm/lispmtopgm.c	2017-09-05 15:59:07.145878261 +0200

@@ -58,6 +58,7 @@ main( argc, argv )

         pm_error( "depth (%d bits) is too large", depth);

     pgm_writepgminit( stdout, cols, rows, (gray) maxval, 0 );

+    overflow_add(cols, 7);

     grayrow = pgm_allocrow( ( cols + 7 ) / 8 * 8 );

     for ( row = 0; row < rows; ++row )

@@ -102,7 +103,9 @@ getinit( file, colsP, rowsP, depthP, pad

     if ( *depthP == 0 )

 	*depthP = 1;	/* very old file */

-    

+

+    overflow_add((int)colsP, 31);

+

     *padrightP = ( ( *colsP + 31 ) / 32 ) * 32 - *colsP;

     if ( *colsP != (cols_32 - *padrightP) ) {

diff -urNp old/converter/pgm/psidtopgm.c new/converter/pgm/psidtopgm.c

--- old/converter/pgm/psidtopgm.c	2017-09-05 15:09:01.002207393 +0200

+++ new/converter/pgm/psidtopgm.c	2017-09-05 15:59:42.457726237 +0200

@@ -78,6 +78,7 @@ main(int     argc,

         pm_error("bits/sample (%d) is too large.", bitspersample);

     pgm_writepgminit(stdout, cols, rows, maxval, 0);

+    overflow_add(cols, 7);

     grayrow = pgm_allocrow((cols + 7) / 8 * 8);

     for (row = 0; row < rows; ++row) {

         unsigned int col;

diff -urNp old/converter/ppm/ilbmtoppm.c new/converter/ppm/ilbmtoppm.c

--- old/converter/ppm/ilbmtoppm.c	2017-09-05 15:09:01.003207388 +0200

+++ new/converter/ppm/ilbmtoppm.c	2017-09-05 16:04:33.011437671 +0200

@@ -606,6 +606,7 @@ decode_row(FILE *          const ifP,

     rawtype *chp;

     cols = bmhdP->w;

+    overflow_add(cols, 15);

     bytes = RowBytes(cols);

     for( plane = 0; plane < nPlanes; plane++ ) {

         int mask;

@@ -693,6 +694,23 @@ decode_mask(FILE *          const ifP,

  Multipalette handling

  ****************************************************************************/

+static void *

+xmalloc2(x, y)

+    int x;

+    int y;

+{

+    void *mem;

+

+    overflow2(x,y);

+    if( x * y == 0 )

+        return NULL;

+

+    mem = malloc2(x,y);

+    if( mem == NULL )

+        pm_error("out of memory allocating %d bytes", x * y);

+    return mem;

+}

+

 static void

 multi_adjust(cmap, row, palchange)

@@ -1355,6 +1373,9 @@ dcol_to_ppm(FILE *         const ifP,

     if( redmaxval != maxval || greenmaxval != maxval || bluemaxval != maxval )

         pm_message("scaling colors to %d bits", pm_maxvaltobits(maxval));

+    overflow_add(redmaxval, 1);

+    overflow_add(greenmaxval, 1);

+    overflow_add(bluemaxval, 1); 

     MALLOCARRAY_NOFAIL(redtable,   redmaxval   +1);

     MALLOCARRAY_NOFAIL(greentable, greenmaxval +1);

     MALLOCARRAY_NOFAIL(bluetable,  bluemaxval  +1);

@@ -1784,7 +1805,9 @@ PCHG_ConvertSmall(PCHG, cmap, mask, data

             ChangeCount32 = *data++;

             datasize -= 2;

+            overflow_add(ChangeCount16, ChangeCount32);

             changes = ChangeCount16 + ChangeCount32;

+            overflow_add(changes, 1);

             for( i = 0; i < changes; i++ ) {

                 if( totalchanges >= PCHG->TotalChanges ) goto fail;

                 if( datasize < 2 ) goto fail;

@@ -2049,6 +2072,9 @@ read_pchg(FILE *     const ifP,

             cmap->mp_change[i] = NULL;

         if( PCHG.StartLine < 0 ) {

             int nch;

+            if(PCHG.MaxReg < PCHG.MinReg)

+                pm_error("assert: MinReg > MaxReg");

+            overflow_add(PCHG.MaxReg-PCHG.MinReg, 2);

             nch = PCHG.MaxReg - PCHG.MinReg +1;

             MALLOCARRAY_NOFAIL(cmap->mp_init, nch + 1);

             for( i = 0; i < nch; i++ )

@@ -2125,6 +2151,7 @@ process_body( FILE *          const ifP,

     if (typeid == ID_ILBM) {

         int isdeep;

+        overflow_add(bmhdP->w, 15);

         MALLOCARRAY_NOFAIL(ilbmrow, RowBytes(bmhdP->w));

         *viewportmodesP |= fakeviewport;      /* -isham/-isehb */

diff -urNp old/converter/ppm/imgtoppm.c new/converter/ppm/imgtoppm.c

--- old/converter/ppm/imgtoppm.c	2017-09-05 15:09:01.003207388 +0200

+++ new/converter/ppm/imgtoppm.c	2017-09-06 09:21:05.977198159 +0200

@@ -84,6 +84,7 @@ main(int argc, char ** argv) {

             len = atoi((char*) buf );

             if ( fread( buf, len, 1, ifp ) != 1 )

                 pm_error( "bad colormap buf" );

+            overflow2(cmaplen, 3);

             if ( cmaplen * 3 != len )

             {

                 pm_message(

@@ -105,6 +106,7 @@ main(int argc, char ** argv) {

                 pm_error( "bad pixel data header" );

             buf[8] = '\0';

             len = atoi((char*) buf );

+            overflow2(cols, rows);

             if ( len != cols * rows )

                 pm_message(

                     "pixel data length (%d) does not match image size (%d)",

diff -urNp old/converter/ppm/Makefile new/converter/ppm/Makefile

--- old/converter/ppm/Makefile	2017-09-05 15:09:01.004207383 +0200

+++ new/converter/ppm/Makefile	2017-09-06 09:21:56.848867561 +0200

@@ -11,7 +11,7 @@ SUBDIRS = hpcdtoppm

 PORTBINARIES =	411toppm eyuvtoppm gouldtoppm ilbmtoppm imgtoppm \

 		leaftoppm mtvtoppm neotoppm \

-		pcxtoppm pc1toppm pi1toppm picttoppm pjtoppm \

+		pcxtoppm pc1toppm pi1toppm pjtoppm \

 		ppmtoacad ppmtoapplevol ppmtoarbtxt ppmtoascii \

 		ppmtobmp ppmtoeyuv ppmtogif ppmtoicr ppmtoilbm \

 		ppmtoleaf ppmtolj ppmtomitsu ppmtoneo \

diff -urNp old/converter/ppm/pcxtoppm.c new/converter/ppm/pcxtoppm.c

--- old/converter/ppm/pcxtoppm.c	2017-09-05 15:09:01.004207383 +0200

+++ new/converter/ppm/pcxtoppm.c	2017-09-06 09:33:20.821565782 +0200

@@ -409,6 +409,7 @@ pcx_planes_to_pixels(pixels, bitplanes,

     /*

      * clear the pixel buffer

      */

+    overflow2(bytesperline, 8);

     npixels = (bytesperline * 8) / bitsperpixel;

     p    = pixels;

     while (--npixels >= 0)

@@ -470,6 +471,7 @@ pcx_16col_to_ppm(FILE *       const ifP,

     }

     /*  BytesPerLine should be >= BitsPerPixel * cols / 8  */

+    overflow2(BytesPerLine, 8);

     rawcols = BytesPerLine * 8 / BitsPerPixel;

     if (headerCols > rawcols) {

         pm_message("warning - BytesPerLine = %d, "

diff -urNp old/converter/ppm/picttoppm.c new/converter/ppm/picttoppm.c

--- old/converter/ppm/picttoppm.c	2017-09-05 15:09:01.003207388 +0200

+++ new/converter/ppm/picttoppm.c	2017-09-06 09:35:38.693912426 +0200

@@ -1,4 +1,6 @@

-/*

+/* !!!WARNING!!! -> error "Unfixable. Don't ship me"

+ *

+ *

  * picttoppm.c -- convert a MacIntosh PICT file to PPM format.

  *

  * Copyright 1989,1992,1993 George Phillips

diff -urNp old/converter/ppm/pjtoppm.c new/converter/ppm/pjtoppm.c

--- old/converter/ppm/pjtoppm.c	2017-09-05 15:09:01.003207388 +0200

+++ new/converter/ppm/pjtoppm.c	2017-09-06 09:39:54.747634431 +0200

@@ -127,19 +127,21 @@ main(argc, argv)

                 case 'V':   /* send plane */

                 case 'W':   /* send last plane */

                     if (rows == -1 || r >= rows || image == NULL) {

-                        if (rows == -1 || r >= rows)

+                        if (rows == -1 || r >= rows) {

+                            overflow_add(rows, 100);

                             rows += 100;

+                        }

                         if (image == NULL) {

-                            MALLOCARRAY(image, rows * planes);

-                            MALLOCARRAY(imlen, rows * planes);

+                            image = (unsigned char **)

+                                malloc3(rows , planes , sizeof(unsigned char *));

+                            imlen = (int *) malloc3(rows , planes,  sizeof(int)); 

                         }

                         else {

+                            overflow2(rows,planes);

                             image = (unsigned char **) 

-                                realloc(image, 

-                                        rows * planes * 

+                                realloc2(image, rows * planes, 

                                         sizeof(unsigned char *));

-                            imlen = (int *) 

-                                realloc(imlen, rows * planes * sizeof(int));

+                            imlen = (int *) realloc2(imlen, rows * planes, sizeof(int));

                         }

                     }

                     if (image == NULL || imlen == NULL)

@@ -212,8 +214,10 @@ main(argc, argv)

                 for (i = 0, c = 0; c < imlen[p + r * planes]; c += 2)

                     for (cmd = image[p + r * planes][c],

                              val = image[p + r * planes][c+1]; 

-                         cmd >= 0 && i < newcols; cmd--, i++) 

+                         cmd >= 0 && i < newcols; cmd--, i++) {                   

                         buf[i] = val;

+                        overflow_add(i, 1);

+                    }

                 cols = cols > i ? cols : i;

                 free(image[p + r * planes]);

                 /* 

@@ -224,6 +228,7 @@ main(argc, argv)

                 image[p + r * planes] = (unsigned char *) realloc(buf, i);

             }

         }

+        overflow2(cols, 8);

         cols *= 8;

     }

diff -urNp old/converter/ppm/ppmtoeyuv.c new/converter/ppm/ppmtoeyuv.c

--- old/converter/ppm/ppmtoeyuv.c	2017-09-05 15:09:01.003207388 +0200

+++ new/converter/ppm/ppmtoeyuv.c	2017-09-06 09:40:38.859425818 +0200

@@ -114,6 +114,7 @@ create_multiplication_tables(const pixva

     int index;

+    overflow_add(maxval, 1);

     MALLOCARRAY_NOFAIL(mult299   , maxval+1);

     MALLOCARRAY_NOFAIL(mult587   , maxval+1);

     MALLOCARRAY_NOFAIL(mult114   , maxval+1);

diff -urNp old/converter/ppm/ppmtoilbm.c new/converter/ppm/ppmtoilbm.c

--- old/converter/ppm/ppmtoilbm.c	2017-09-05 15:09:01.004207383 +0200

+++ new/converter/ppm/ppmtoilbm.c	2017-09-06 09:48:06.002139282 +0200

@@ -190,6 +190,7 @@ makeValTable(int const oldmaxval,

     unsigned int i;

     int * table;

+    overflow_add(oldmaxval, 1);

     MALLOCARRAY_NOFAIL(table, oldmaxval + 1);

     for (i = 0; i <= oldmaxval; ++i)

         table[i] = ROUNDDIV(i * newmaxval, oldmaxval);

@@ -1644,6 +1645,7 @@ ppmToRgb8(FILE * const ifP,

     maskmethod = 0;     /* no masking - RGB8 uses genlock bits */

     compmethod = 4;     /* RGB8 files are always compressed */

+    overflow2(cols, 4);

     MALLOCARRAY_NOFAIL(compr_row, cols * 4);

     if( maxval != 255 ) {

@@ -1735,6 +1737,7 @@ ppmToRgbn(FILE * const ifP,

     maskmethod = 0;     /* no masking - RGBN uses genlock bits */

     compmethod = 4;     /* RGBN files are always compressed */

+    overflow2(cols, 2);

     MALLOCARRAY_NOFAIL(compr_row, cols * 2);

     if( maxval != 15 ) {

@@ -2298,8 +2301,11 @@ main(int argc, char ** argv) {

         MALLOCARRAY_NOFAIL(coded_rowbuf, RowBytes(cols));

         for (i = 0; i < RowBytes(cols); ++i)

             coded_rowbuf[i] = 0;

-        if (DO_COMPRESS)

+        if (DO_COMPRESS) {

+            overflow2(cols,2);

+            overflow_add(cols*2,2);

             pm_rlenc_allocoutbuf(&compr_rowbuf, RowBytes(cols), PM_RLE_PACKBITS);

+        }

     }

     switch (mode) {

diff -urNp old/converter/ppm/ppmtolj.c new/converter/ppm/ppmtolj.c

--- old/converter/ppm/ppmtolj.c	2017-09-05 15:09:01.002207393 +0200

+++ new/converter/ppm/ppmtolj.c	2017-09-06 09:48:48.400910976 +0200

@@ -182,6 +182,7 @@ int main(int argc, char *argv[]) {

     ppm_readppminit( ifp, &cols, &rows, &maxval, &format );

     pixelrow = ppm_allocrow( cols );

+    overflow2(cols, 6);

     obuf = (unsigned char *) pm_allocrow(cols * 3, sizeof(unsigned char));

     cbuf = (unsigned char *) pm_allocrow(cols * 6, sizeof(unsigned char));

     if (mode == C_TRANS_MODE_DELTA)

diff -urNp old/converter/ppm/ppmtomitsu.c new/converter/ppm/ppmtomitsu.c

--- old/converter/ppm/ppmtomitsu.c	2017-09-05 15:09:01.003207388 +0200

+++ new/converter/ppm/ppmtomitsu.c	2017-09-06 09:49:28.752692414 +0200

@@ -685,6 +685,8 @@ main(int argc, char * argv[]) {

         medias = MSize_User;

     if (dpi300) {

+        overflow2(medias.maxcols, 2);

+        overflow2(medias.maxrows, 2);

         medias.maxcols *= 2;

         medias.maxrows *= 2;

     }

diff -urNp old/converter/ppm/ppmtopcx.c new/converter/ppm/ppmtopcx.c

--- old/converter/ppm/ppmtopcx.c	2017-09-05 15:09:01.003207388 +0200

+++ new/converter/ppm/ppmtopcx.c	2017-09-06 09:50:31.104352461 +0200

@@ -425,6 +425,8 @@ ppmTo16ColorPcx(pixel **            cons

             else                   Planes = 1;

         }

     }